UNITED STATES OF AMERICA 



v. 



Manning, Bradley E. 

PFC, U.S. Army, 

HHC, U.S. Army Garrison, 

Joint Base Myer-Henderson Hall 

Fort Myer, Virginia 22211 



STIPULATION OF 
EXPECTED TESTIMONY 

SA Charles Clapper 
DATED: 3 June 2013 



It is hereby agreed by the Accused, Defense Counsel, and Trial Counsel, that if Special 
Agent (SA) Charles Clapper were present to testify during the merits and pre-sentencing phases of 
this court-martial, he would testify substantially as follows. 

1 . I am a Special Agent (SA) for the U.S. Army Criminal Investigation Division (CID). 
Specifically, I work for the CID, Computer Crimes Investigation Unit (CCIU). My current job 
title is Special Agent in Charge (SAC) of the Arizona Branch Office located at Fort Huachuca, 
Arizona. As the SAC, I run a two-man office that handles exclusively computer crimes. My job 
also entails serving as CID's liaison officer for NETCOM. Additionally, I am the liaison officer 
to the Regional Computer Emergency Response Team (RCERT-CONUS) and to the Theater 
Network Operations and Security Center (TNOSC). I have served in Arizona as an SA for five 
years and I have been the SAC for three of the five years. 

2. From 1986-1999, 1 was an enlisted Military Police officer (MP). I served as an Evidence 
Custodian for the Investigation Section at Fort Lewis, Washington from 1993-1994. After 
becoming a CID agent in 1999, from 1999-2002, 1 served as the Computer Crimes Coordinator for 
the 5th MP Battalion in Kaiserslaughtern, Germany. I was also the Evidence Custodian for the 
Kaiserslaughtern CID Office from 2001-2002. I served as the Detachment Sergeant and as an 
Evidence Custodian from 2004-2006 at CCIU on Fort Belvoir, Virginia. In 2007, 1 was an 
INSCOM contractor performing forensics for the Army's Computer Emergency Response Team 
(Army CERT) in the Forensics and Malware Analysis department. I became a civilian Special 
Agent in Arizona in 2008, and currently serve in this capacity. 

3. I received a Bachelor of Science degree in Liberal Arts from Regents College located in New 
York. I have had extensive training in evidence collection and handling. This includes having 
attended the 17-week Apprentice Special Agents Course. I have also attended the Advanced 
Crime Scene Investigation class at Fort Leonard Wood and the SALT Special Agent Course at the 
Army Crime Lab located at Fort Gillem, Georgia. In terms of computer and forensic training, I 
have taken numerous courses at the Defense Cyber Investigative Training Academy in Linthicum, 
Maryland. I took these courses between the years 2000 and 2008. They covered a full range of 
computer forensics and digital media collection issues. Between 2003 and 2006, 1 attended two 
courses at Guidance Software in Reston, Virginia. This company manufactures the forensic 
imaging software EnCase. In 2012, 1 attended the Federal Law Enforcement Training Center 
Computer Network Intrusion Training program in Glynco, Georgia. These courses all discussed 
the collection and handling of digital evidence. 

4. I have a Department of Defense Cyber Crime Investigation Certificate from the Department of 
Defense Cyber Crime Center, which is the highest certification that one can receive in the field. (Q^ 
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The certification must be renewed every two years. I received my first certification in 2006 and 
last renewed it in October of 2012. In addition to my training and certifications, I have worked 
more than 100 cases in my current duty position and somewhere between 100-200 cases in my 
previous capacities. 

5. I follow several general procedures when handling evidence. I review the custody document 
and always ensure the description of the evidence matches the evidence attached. I check, for 
example, that recorded serial numbers, markings for identification, and condition description 
match the associated evidence. I ensure that the appropriate information, such as date and time, 
are properly and accurately recorded. Lastly, I maintain secure custody of the evidence prior to 
transferring it to another individual. 

6. In this particular investigation, I worked with SA Antonio Edwards and assisted with witness 
interviews and the handling of evidence. On 12 June 2010, 1 received evidence related to this 
investigation from SA Edwards. I also received two Consent to Search forms (CID Forms 87-R- 
E), signed by Mr. Adrian Lamo on 12 June 2010, which gave signed consent to law enforcement 
personnel to search his electronic devices for u [a]ll information in any form, pertaining to 
communications which may be in the form: of emails, instant messaging chats, documents, data, 
computer code, log files, drawings, photographs, or any other data; in encrypted, plain text, or any 
other format; relating to PFC Bradley E. MANNING and/or the disclosure of classified 
information or information which is the property of the U.S. Government." The first piece of 
evidence collected and further handled was a Lenovo Laptop computer with a Fujitsu computer 
hard drive (serial number: K404T812MF4D) recorded as Item 1 on a DA Form 4137, marked as 
document number (DN) 76-10, and known as "Lamo Ubuntu Hard Drive". It was collected from 
Mr. Adrian Lamo in Sacramento, California on 12 June 2010. The second piece of evidence 
collected and further handled was an HP Mini Brand computer (computer serial number: 
CNU90513VT) with a Seagate computer hard drive (serial number: 5RE2C1QK) recorded as 
Item 1 on a DA Form 4137, marked as document number (DN) 77-10, and known as "Lamo HP 
Hard Drive". It was collected from Mr. Adrian Lamo in Carmichael, California on 12 June 2010. 

7. I imaged both pieces of evidence using standard forensic imaging software, which does not 
alter the original evidence in any way. A forensic image is a bit-for-bit or exact copy of the 
original information on the hard drive. Using the DA Form 4137, 1 properly released the original 
evidence back to SA Edwards on 14 June 2010. While in possession of these items, I maintained 
control over them. I returned the items in the same condition that I received them and have no 
reason to believe that the evidence was damaged or contaminated in any way. After releasing the 
evidence to SA Edwards, I had no further interaction with the evidence. 




THOMAS F. HURLEY 
MAJ, JA 
Defense Counsel 



CPT, JA 

Assistant Trial Counsel 
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